Advanced Poll up to 1.60 Flat File Database logged_in privileges management

Summaryinfo

A vulnerability marked as critical has been reported in Advanced Poll up to 1.60. This issue affects some unknown processing of the component Flat File Database Handler. The manipulation of the argument logged_in leads to privileges management. This vulnerability is listed as CVE-2001-1423. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Advanced Poll up to 1.60 (Survey Software) and classified as critical. This issue affects an unknown code of the component Flat File Database Handler. The manipulation of the argument logged_in with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Advanced Poll before 1.61, when using a flat file database, allows remote attackers to gain privileges by setting the logged_in parameter.

The weakness was presented 10/10/2001 as confirmed advisory (CERT.org). It is possible to read the advisory at kb.cert.org. The identification of this vulnerability is CVE-2001-1423 since 03/20/2005. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.61 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (7861) and SecurityTracker (ID 1002516†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Survey Software

Name

• Advanced Poll

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53
• 1.54
• 1.55
• 1.56
• 1.57
• 1.58
• 1.59
• 1.60

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion